Executive brief
A security flaw in macOS could allow malicious files to bypass Gatekeeper, the system's built-in security feature that verifies apps before they run. By using a specially crafted ZIP archive, an attacker could trick the system into running untrusted software without the usual security warnings. This could lead to the installation of malware or unauthorized access to user data if a user is persuaded to open a malicious file.
Technical details
A vulnerability in macOS Gatekeeper's handling of ZIP archives allowed for a file quarantine bypass. The issue stemmed from insufficient validation of archive structures, which could be exploited using a maliciously crafted ZIP file to circumvent the 'com.apple.quarantine' attribute and Gatekeeper's signature verification. An attacker could deliver such an archive via the network (e.g., email or web download); if a user extracts and opens the contents, arbitrary untrusted code could execute. Apple addressed this by implementing additional checks within the quarantine logic. The fix is available in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8.
Affected products
- Apple macOS Sequoia Before 15.7.8
- Apple macOS Sonoma Before 14.8.8
Timeline
- 2026-07-27: disclosed
- 2026-07-27: patched